Network Security Essentials

Network Security

Essentials

Fifth Edition

by William Stallings

Chapter 12Firewalls

The function of a strong position is to make the forces holding it practically unassailable.

— On War, Carl Von ClausewitzOn the day that you take up your

command, block the frontier passes, destroy the official tallies, and stop the passage of all emissaries.

—The Art of War, Sun Tzu

The Need for firewalls• Internet connectivity is no longer optional for organizations

• Individual users within the organization want and need Internet access

• While Internet access provides benefits to the organization, it enables the outside world to reach and interact with local network assets• This creates a threat to the organization• While it is possible to equip each workstation and server on the premises

network with strong security features, this may not be sufficient and in some cases is not cost-effective

• Firewall• An alternative, or at least complement, to host-based security services• Is inserted between the premises network and the Internet to establish a

controlled link and to erect an outer security wall or perimeter• The aim of this perimeter is to protect the premises network from

Internet-based attacks and to provide a single choke point where security and auditing can be imposed

• May be a single computer system or a set of two or more systems that cooperate to perform the firewall function

Firewall characteristics• Design goals for a firewall:

• All traffic from inside to outside, and vice versa, must pass through the firewall

• Only authorized traffic, as defined by the local security policy, will be allowed to pass

• The firewall itself is immune to penetration

• Techniques that firewalls use to control access and enforce the site’s security policy:

Firewall expectations

Firewall limitations

A Firewall

Table 12.1Packet-Filtering Example

Packet Filtering firewalls

Attacks and countermeasures

Table 12.2Example Stateful Firewall Connection State Table

[SCAR09b]

Application Level Gateway• Also called an application proxy

• Acts as a relay of application-level traffic• If the gateway does not implement the proxy code for a

specific application, the service is not supported and cannot be forwarded across the firewall

• The gateway can be configured to support only specific features of an application that the network administrator considers acceptable while denying all other features

• Tend to be more secure than packet filters• Disadvantage:

• The additional processing overhead on each connection

Circuit-Level Gateway• Also called circuit-level proxy

• Can be a stand-alone system or it can be a specialized function performed by an application-level gateway for certain applications

• Does not permit an end-to-end TCP connection• The security function consists of determining which

connections will be allowed• Typical use is a situation in which the system administrator

trusts the internal users• Can be configured to support application-level or proxy service

on inbound connections and circuit-level functions for outbound connections

• Example of implementation is the SOCKS package

Bastion Host• A system identified by the firewall administrator as a critical strong point in the

network’s security• Typically serves as a platform for an application-level or circuit-level gateway• Common characteristics:

• Executes a secure version of its operating system, making it a hardened system• Only the services that the network administrator considers essential are installed• May require additional authentication before a user is allowed access to the proxy services• Each proxy is configured to support only a subset of the standard application’s command

set• Each proxy is configured to allow access only to specific host systems• Each proxy maintains detailed audit information by logging all traffic, each connection, and

the duration of each connection• Each proxy module is a very small software package specifically designed for network

security• Each proxy is independent of other proxies on the bastion host• A proxy generally performs no disk access other than to read its initial configuration file• Each proxy runs as a nonprivileged user in a private and secured directory on the bastion

host

Host-Based Firewall• A software module used to secure an individual host• Is available in many operating systems or can be

provided as an add-on package• Filters and restricts the flow of packets• Common location is a server• Advantages:

• Filtering rules can be tailored to the host environment• Protection is provided independent of topology• Used in conjunction with stand-alone firewalls, provides

an additional layer of protection

Personal Firewall• Controls the traffic between a personal computer or

workstation on one side and the Internet or enterprise network on the other side

• Can be used in the home environment and on corporate intranets

• Typically is a software module on the personal computer• Can also be housed in a router that connects all of the home

computers to a DSL, cable modem, or other Internet interface• Primary role is to deny unauthorized remote access to the

computer• Can also monitor outgoing activity in an attempt to detect and

block worms and other malware

Figure 12.2 Example Personal Firewall Interface

Summary of Firewall Locations and Topologies

• Host-resident firewall• This category includes personal firewall

software and firewall software on servers

• Can be used alone or as part of an in-depth firewall deployment

• Screening router• A single router between internal and

external networks with stateless or full packet filtering

• This arrangement is typical for small office/home office (SOHO) applications

• Single bastion inline• A single firewall device between an

internal and external router• This is the typical firewall appliance

configuration for small-to-medium sized organizations

• Single bastion T• Similar to single bastion

inline but has a third network interface on bastion to a DMZ where externally visible servers are placed

• Double bastion inline• DMZ is sandwiched between

bastion firewalls• Double bastion T

• DMZ is on a separate network interface on the bastion firewall

• Distributed firewall configuration• Used by some large

businesses and government organizations

Summary• The need for firewalls• Firewall

characteristics• Types of firewalls

• Packet filtering firewall

• Stateful inspection firewalls

• Application level gateway

• Circuit level gateway

• Firewall basing• Bastion host• Host based firewalls• Personal firewall

• Firewall locations and configurations• DMZ networks • Virtual private

networks• Distributed firewalls• Firewall location and

topologies summary